SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

1
vote
1answer
47 views

How long does an HTTPS symmetric key last

As I understand it, HTTPS/SSL/TLS works by EC/DHE/RSA key exchange, providing a shared symmetric key (ie. for AES) that is used for future communications. How long is this symmetric key kept in use ...
13
votes
1answer
874 views

How is password stolen over non-SSL connection?

I am semi-embarrassed to ask this question having worked in the field for 20 years, but can someone describe to me why I should run SSL on any web site that uses authentication? I understand the ...
3
votes
3answers
832 views

Heartbleed - Read only the next 64k and hyping the threat

My understanding of the Heartbleed vulnerability is that there is no bounds check on the payload length/buffer size so the server can read into memory outside of its process space. But can the start ...
-1
votes
1answer
282 views

What is HeartBleed? [duplicate]

Today when I woke up , I got a email from Godaddy that contain “A critical vulnerability with OpenSSL, known as 'The Heartbleed Bug' was recently announced that could potentially impact your server“ ...
0
votes
0answers
58 views

how to setup apache http server with the vulnerable openssl [migrated]

Actually I just want to do some test, so I want to setup an apache http server with the vulnerable (specifically with heartbleed bug) openssl, I'd better do it from source. Does anyone know how to ...
1
vote
2answers
98 views

LastPass login security

If LastPass does not store your master password, then how can you login to use their web app? Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and ...
10
votes
2answers
1k views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
1
vote
3answers
80 views

Is it possible to stack encryption algorithms with SSL?

SSL supports a number of ciphers, but is it possible to stack/nest the ciphers, and process the plaintext in stages? My adversary may be able to easily crack one or more of the stages, but to decode ...
2
votes
1answer
624 views

Heartbleed - Blown out of proportion? [duplicate]

From what I gather you need local memory based access correct to even access the private key? Is all this talk and worry of "Was I hacked?!" "Heartbleed just made you full hackable" ect... really over ...
1
vote
2answers
2k views

Does “heartbeat extension disabled” mean that the site was previously vulnerable?

One of the services I use is saying they were unaffected by heartbleed. But when I check their site with the tool at http://possible.lv/tools/hb/, this is what it says: Looking for TLS extensions on ...
1
vote
0answers
24 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
56
votes
3answers
30k views

What clients are proven to be vulnerable to Heartbleed?

On several pages, it is re-iterated that attackers can obtain up to 64K memory from the server or client that use an OpenSSL implementation vulnerable to Heartbleed (CVE-2014-0160). There are dozens ...
1
vote
1answer
186 views

OpenSSL exploit [closed]

I have read about recent vulnerability in openssl. I tried to exploit one of my cloud servers where I run my web sites. I managed to get 64 KB of data. But what I managed to get was only HTML, CSS, ...
19
votes
3answers
3k views

Why does TLS need an explicit heartbeat protocol?

The heartbeat extension to the TLS protocol seems like a useful idea for DTLS; according to the specification itself, it can be used to find out if a peer is still alive (and prevent firewalls from ...
2
votes
2answers
102 views

What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)?

See here: https://www.cacert.org/index.php?id=1 Chrome, Firefox and Internet Explorer warn that it is not trusted, essentially making the entire thing useless. If I want some kind of ssl certificate, ...
1
vote
2answers
431 views

Is Apache serving over HTTP vulnerable to Heartbleed? [duplicate]

I run a server whose only public open port is 80, serving non-encrypted data over HTTP, not HTTPS. Is it affected by Heartbleed?
1
vote
1answer
1k views

I don't use TLS extensions, I'm safe of HeartBleed? [closed]

I know that the vulnerability exploits the Heartbeat response which is a TLS feature. Now, when testing some of my important sites, there was some wording that scared me, namely: TLS extension 15 ...
2
votes
1answer
69 views

Which Browsers support TACK?

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' bowsers support it. Unlike the certificate pinning feature available with HSTS preloading, the ...
4
votes
3answers
1k views

HeartBleed - How to detect compromised websites

Is there a way to determine as an end-user which HTTPS sites use OpenSSL? Due to heartbleed it is recommended that clients change their passwords that were sent over TLS recently as private keys may ...
2
votes
1answer
46 views

How does the Perspective addon work?

I've just installed the Perspetive addon in firefox. When I'm vistit, for example google, Perspective says the following message: Warning: Perspectives has NOT seen this certificate consistently. ...
9
votes
1answer
731 views

Are networks using EAP-TLS affected by Heartbleed?

Does the Heartbleed bug affect WiFi networks secured by WPA2-EAP in TLS mode? Since it's using TLS to secure connections between the server and clients, is it possible to attack the server using the ...
55
votes
4answers
21k views

Does Heartbleed mean new certificates for every SSL server?

If you haven't heard of the Heartbleed Bug, it's something to take a look at immediately. It essentially means that an attacker can exploit a vulnerability in many versions of OpenSSL to be able to ...
1
vote
1answer
80 views

DNS causing SSL errors

On my old ISP's DNS servers, sometimes https://www.facebook.com would return a cert for Akamai instead of Facebook. What I don't understand is that changing my DNS server to Googles (8.8.8.8) fixes ...
0
votes
2answers
63 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
0
votes
1answer
60 views

Why do I need a certificate to pin an SSL connection with AF Networking 2?

I am using the AF Networking 2 library and read that I need to include the server's certificate here. The client should be able to tell that the certificate is valid when it connects to the server, ...
0
votes
1answer
45 views

How does the Subterfuge toolkit bypass SSL? [closed]

As the title says, does anybody know how Subterfuge bypasses the SSL layer?
1
vote
2answers
56 views

Proving SSL need

I need to prove the need we have to install SSL certificates in our webservers. For that I've been requested to try obtaining sample credentials (in lab enviroment) during a http authentication ...
0
votes
0answers
19 views

SChannel SSL 3.0 error - OWA - Windows Server 2008 R2 [migrated]

I am receiving errors in the event log with ID numbers 36888 and 36874. The errors state "The following fatal alert was generated: 40. The internal error state is 1205." and "An SSL 3.0 connection ...
43
votes
5answers
3k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, ...
2
votes
1answer
55 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
8
votes
2answers
680 views

HTTPS login vs MITM attack

http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
1
vote
2answers
56 views

How Web-proxy and Virtual-Hosting are complications for HTTPS?

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting. I can understand how ...
2
votes
1answer
79 views

REST security using only API key and SSL

I am looking to build a number of simple REST web services where: they only need to be called by server-side clients (i.e. no mobile/javascript/desktop) they are only accessible by HTTPS (no ...
0
votes
1answer
93 views

Accepting an untrusted security certificate?

What is the risk of accepting an untrusted site security certificate in your browser if you're not entering any data, but merely browsing the site?
1
vote
3answers
106 views

Protecting form post values when on https

I am dealing with a multi-step form, and I need to pass information from step 1 to step 2, then from step 2 to step 3, and so on. Step 1 contains a membership number and ID number entry, as well as ...
1
vote
3answers
110 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
1
vote
2answers
303 views

Self-signed SSL certificate on chromebook (and android)

I am having the following problem on both my android phone and on my chromebook. I'm running a website on an internal server (10.3.3.3) using nginx with a self-signed ssl certificate. Since it is just ...
1
vote
4answers
564 views

nginx recommended ssl_ciphers for security, compatibility - with PFS

I'm currently using nginx with the following ciphers: ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; I would like to maintain compatibility to older ...
1
vote
0answers
61 views

Threats against website running without TLS but with PGP messages

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier) The information flow is as such: 1. Session ID set on ...
4
votes
1answer
180 views

WebRTC P2P SSL - Where are the keys generated?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, ...
2
votes
2answers
84 views

Does SNI reveal the virtualhost during the CONNECT query to a HTTPS proxy?

Also, the name of the actual virtualhost is going through unencrypted or not?
-1
votes
0answers
20 views

TLS/SSL's usage of Non-Ephemeral DH vs DHE [migrated]

These questions revolve around DH and ECDH vs DHE and ECDHE. Specifically within the context of TLS/SSL. There are three questions in total (and a fourth bonus question). The goal of using ...
0
votes
3answers
117 views

HTTP/HTTPS on the same site

Suppose a site allows connection to be established with HTTP or HTTPS .If you establish a connection to http://www.example.com or https://www.example.com then all further link's on the page displayed ...
10
votes
1answer
455 views

How can SSL vendors limit the amount of servers they can be installed on?

I've recently purchased an SSL certificate, and it says that it's limited to three servers. Surely if I have the key and certificate on multiple servers (more than 3), the SSL will still be valid? Can ...
2
votes
1answer
153 views

In SSL/TLS, what part of a data packet is Encrypted and Authenticated?

I'm trying to wrap my head around the Application Data record that carries secured traffic. I understand TLS/SSL is a "authenticate-then-encrypt" protocol, which means an HMAC is calculated over the ...
1
vote
1answer
66 views

What's the point of the pre-master key? [duplicate]

In SSL, the client generates a pre-master key from random data from itself and also the server. It then encrypts this with the server's public key, sends it to the server and then both client and ...
0
votes
3answers
105 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
3
votes
5answers
187 views

Free SSL Certificate when encryption is needed and not trust?

My understanding is that SSL certificates are expensive because you are paying a 3rd party to vouch for your identity, and apparently the most secure form of trust is the trust you have to pay for. ...
1
vote
2answers
54 views

How can I see if SSL Certificate is Business SSL? [duplicate]

I'm trying to see the visual difference between Business SSL Validation and Standard Validation but I see no difference (or I cannot find a site which contains a Business SSL certificate) Is there a ...
1
vote
0answers
123 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...